From 880fa4053910a4e22e57ed82a463c3c020175292 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 30 Apr 2026 11:51:36 +0200
Subject: [PATCH] Return OIDC errors instead of "failed to decode token"

---
 CHANGELOG.md                             |  1 +
 crates/common/src/auth/authentication.rs | 23 +++++++++++++++++++----
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f65cef1..05dcb3b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Fixed
 - Directory: 
   - Invalidate caches when group memberships change on an external directory.
+  - Return OIDC errors instead of "failed to decode token".
   - User impersonation.
 - Log viewer: All events show as `INFO`.
 - Registry: Allow changing object variants.
diff --git a/crates/common/src/auth/authentication.rs b/crates/common/src/auth/authentication.rs
index 829925e1..45416bc3 100644
--- a/crates/common/src/auth/authentication.rs
+++ b/crates/common/src/auth/authentication.rs
@@ -331,6 +331,9 @@ impl Server {
                 } else {
                     self.get_default_directory()
                 };
+
+                // Try external directory authentication first if supported, then fallback to internal OAuth.
+                let mut external_error = None;
                 if let Some(directory) = directory
                     && directory.has_bearer_token_support()
                 {
@@ -341,18 +344,30 @@ impl Server {
                         Err(err) => {
                             if !err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)) {
                                 return Err(err);
+                            } else {
+                                external_error = Some(err);
                             }
                         }
                     }
                 }
 
                 // Internal OAuth
-                let token_info = self
+                match self
                     .validate_access_token(GrantType::AccessToken.into(), token)
-                    .await?;
-                self.access_token(token_info.account_id)
                     .await
-                    .and_then(|token| AccessToken::new(token, req.remote_ip))
+                {
+                    Ok(token_info) => self
+                        .access_token(token_info.account_id)
+                        .await
+                        .and_then(|token| AccessToken::new(token, req.remote_ip)),
+                    Err(err) => {
+                        if let Some(external_error) = external_error {
+                            Err(external_error)
+                        } else {
+                            Err(err)
+                        }
+                    }
+                }
             }
         }
     }